Environments
Sandbox and production are the same API on different keys. Where they differ, stated exactly.
There are two environments, sandbox and production, and they are the same code on different keys. The environment is encoded in the key itself, so nothing in a request body can select one — which means a sandbox integration cannot accidentally reach production by sending the wrong field.
Both are issued at onboarding. There is no public sandbox signup.
Where they differ
Routes, schemas, validation, error envelope, pagination, rate-limit headers and the decision codes are identical. What differs by design:
| Sandbox | Production | |
|---|---|---|
| Signing key | verdicts signed under a kid beginning sandbox- | verdicts signed under the production kid |
| Default enforcement mode | enforce | observe |
The signing difference is the important one for a counterparty: a kid beginning sandbox- must never be accepted as a production approval. Both keys are published side by side in the same public key set, so telling them apart is a string comparison, not a phone call.
The default mode difference is deliberate. A new sandbox blocks, so you see denials immediately while you are still writing code. A new production environment does not, so switching on Saifuro cannot take down your payments on day one — you move it yourself, when the evidence says to, as described in observe mode.
Observe mode is not an environment
It is a state of production in which every request is still evaluated, still costs a decision and still lands in the log, but nothing is blocked. The mode field on every decision records which state produced it, so a decision from observe and a decision from enforce are distinguishable forever after, including in an export.
One consequence worth stating plainly: in observe mode the API still returns deny_* verdicts. It is your client that stops blocking on them. Saifuro does not become quiet — it becomes advisory.